AF#3 (Rear O2 sensor) correction limits

ShagginWagin · **Joined:** Fri Sep 04, 2020 1:16 am **Posts:** 2

Hows it goin guys, can I get the address for the Legacy GT? (A2WC521C) I'm a bit of a noob to all of this, thanks for the help!

ShagginWagin · **Joined:** Fri Sep 04, 2020 1:16 am **Posts:** 2

For anyone that is looking for the above address, the correction is located at 2DF2C.

kareston · **Posted:** Sun Oct 04, 2020 3:40 pm

Can someone pls explain how to search in IDA for this code what should I see there? Seems that I can't really understand this "how to" on the 1`st page. And does IDA freeware work for this?
P.S why there is no update on rommraider and ecuflash defs files with this kind of stuff?

pyro6314 · **Joined:** Sun Dec 01, 2013 8:17 pm **Posts:** 47

td-d wrote:

So - turns out in the older roms where the adders are used, there's a second set of adders based on TPS % in a 2D, 9 cell table. Didn't see it, since I rarely come across these older roms.

Add this to the 32bit base (I'll also upload to github)

Code:

   <scaling name="AF3_Adder2" units="units" toexpr="x*0.000015258789" frexpr="x/0.000015258789" format="%.6f" min="0" max="255" inc="1e-05" storagetype="uint16" endian="big"/>

   
   <table name="AF 3 Correction Adder (Increase) B" category="ALPHA AF 3 (Rear O2 Sensor)" type="2D" level="1" scaling="AF3_Adder2">
      <table name="TPS Opening %" type="Y Axis" elements="9" scaling="TargetThrottlePlateOpeningAngle(%)1"/>
   </table>

   <table name="AF 3 Correction Adder (Decrease)" category="ALPHA AF 3 (Rear O2 Sensor)" type="2D" level="1" scaling="AF3_Adder2">
      <table name="TPS Opening %" type="Y Axis" elements="9" scaling="TargetThrottlePlateOpeningAngle(%)1"/>
   </table>

and for AZ2J500F.xml

Code:

   <table name="AF 3 Correction Adder (Increase) B" address="53d9c">
      <table name="TPS Opening %" address="53d78"/>
   </table>

   <table name="AF 3 Correction Adder (Decrease) B" address="53dd4">
      <table name="TPS Opening %" address="53db0"/>
   </table>

Could someone please define this for A2ZJE11J? (06sti)?

reneiver · **Joined:** Mon Nov 23, 2020 11:08 am **Posts:** 3

Could anyone help me find the AF3 correction (adder and decreaser) and AF3 closed loop target compensation addresses for A2UI000Y? I searched up 3F 00 00 00 BF 00 00 00 in IDA Pro but only 3 addresses came up: 32D83, 3327F and 3490B. None of them seem to correspond to what I'm looking for.

cortin · **Posted:** Sun Nov 29, 2020 1:52 pm

reneiver wrote:

Could anyone help me find the AF3 correction (adder and decreaser) and AF3 closed loop target compensation addresses for A2UI000Y? I searched up 3F 00 00 00 BF 00 00 00 in IDA Pro but only 3 addresses came up: 32D83, 3327F and 3490B. None of them seem to correspond to what I'm looking for.

032CE8 AF 3 CL Target Compensation Limits
034870 AF 3 Correction Limits

reneiver · **Joined:** Mon Nov 23, 2020 11:08 am **Posts:** 3

cortin wrote:

reneiver wrote:

Could anyone help me find the AF3 correction (adder and decreaser) and AF3 closed loop target compensation addresses for A2UI000Y? I searched up 3F 00 00 00 BF 00 00 00 in IDA Pro but only 3 addresses came up: 32D83, 3327F and 3490B. None of them seem to correspond to what I'm looking for.

032CE8 AF 3 CL Target Compensation Limits
034870 AF 3 Correction Limits

Thank you very much!

pyro6314 · **Joined:** Sun Dec 01, 2013 8:17 pm **Posts:** 47

A2ZJE11J:

Code:

      <table name="AF 3 Correction Adder (Increase) B" address="c69e4">
      <table name="TPS Opening %" address="c69c0"/>
   </table>

   <table name="AF 3 Correction Adder (Decrease) B" address="c69ac">
      <table name="TPS Opening %" address="c6988"/>
   </table>

PsIho · **Joined:** Thu Mar 18, 2021 3:33 pm **Posts:** 3

Hello everyone. SG5 A8AK210A I'm trying to disable the rear O2 AF#3 corrections. Found 2 addresses of the 3F000000 BF000000 string: 1a1ec, 188ec. Can I get some assistance? :roll:

Bamofo · **Joined:** Mon Jul 02, 2007 11:46 am **Posts:** 430

PsIho wrote:

Hello everyone. SG5 A8AK210A I'm trying to disable the rear O2 AF#3 corrections. Found 2 addresses of the 3F000000 BF000000 string: 1a1ec, 188ec. Can I get some assistance? :roll:

Sent you a PM to test. if it works you can share the file here.

currancchs · **Posted:** Thu Mar 25, 2021 5:42 pm

td-d wrote:

List of addresses for various roms:

AZ1J500G :31398
AZ1E400U: 2FD90
A8DK100P: 30E10
AE5F301C: 31F7C
AZ1G900P: 2FE4C
AZ1G101N: 30040
AZ1G201: 2FAE0
A8DH200O:2D464
A8DH200V: 2D464
AE5IA10V:3447c
AZ1G400W: 30040

Here are some more for your list

AF3 Correction:
EZ1GB10K - 30424

AF3 CL Target Comp Limits:
EZ1GB10K - 2EB8C

I haven't logged to verify, but the routines that utilize these values are identical to those seen in other ROMs where the values were confirmed.

rhino6303 · **Joined:** Sun Feb 06, 2011 10:12 pm **Posts:** 41

Can someone please find the addresses for A/F 3 and A/F 4 correction/limits for DZ1E402B please?

Alex_Ukraine · **Joined:** Mon Aug 23, 2021 6:47 pm **Posts:** 1

td-d wrote:

Ok, confirmed

I have indeed found the AF#3 Rear O2 correction limits. Stock is set to -50% / 50% (!), so it's always on basically. I set it to 1% to test, and stuck nicely to those limits. I believe that if you set these limits to zero, you basically remove the effect of the rear O2 sensor. I am in the process of uncovering the AF#3 learning limits, rear O2 sensor limits and the so-called 'adders' for AF#3, and will post as soon as I have digged them up.

For the '08 EDM Sti (AZ1G201 /2G), the Ecuflash definition is as follows:

Code:

<table name="AF 3 Correction Limits" address="2fae0" type="2D" level="1" scaling="A/FLearning#1Limits(%)">
      <table name="X" type="Static X Axis" elements="2">
         <data>High</data>
         <data>Low</data>
      </table>
   </table>

EDIT - How to find
Here's a general guideline on how to find the values in your rom.

In IDA, do a search for 3F 00 00 00 BF 00 00 00 (all results). You will get 4 or 5 results depending on your Rom. These are the -0.5 and 0.5 sequences. Usually it is the third one that's the AF3 correction limits. In some roms (like A8DK100P) it can be the first one. EDIT - looks like if you search for 3F000000 BF000000 4F22C79A F808D59A you get the exact location (as it is always followed by a routine that leads to the primary open looping fueling routine).

You will know it the right address by looking for the following - there are two subroutines above the sequence (that check the outer ranges) and usually 4 offsets for maps that are 2d, 9 cells and with a multiplier of 0.000015259022 and an adder of -0.5. E.g.

Code:

ROM:00085998 word_85998:     .data.w 9               ; DATA XREF: sub_2F4F0+708o
ROM:00085998                                         ; ROM:off_2FD78o
ROM:0008599A                 .data.w h'800
ROM:0008599C                 .data.l h'C9680
ROM:000859A0                 .data.l dword_C96A4
ROM:000859A4                 .float 0.000015259022
ROM:000859A8                 .float -0.5

You will also see a float above the 0.5 and -0.5 of 0.000019073486.

List of addresses for various roms:

AZ1J500G :31398
AZ1E400U: 2FD90
A8DK100P: 30E10
AE5F301C: 31F7C
AZ1G900P: 2FE4C
AZ1G101N: 30040
AZ1G201: 2FAE0
A8DH200O:2D464
A8DH200V: 2D464
AE5IA10V:3447c
AZ1G400W: 30040

Greetings from Ukraine!
Please help me find the addresses of the correction limits for the second
oxygen sensor for my 2008 Subaru Outback
ID ~ E2TB101L
I plan to edit in EcuFlash, since there are no E2TB101L definitions for
RomRider ((((
I am a beginner and this is my first attempt to flash my ECU. This need
arose after the removal of the catalyst (first).
There are no normal specialists in Ukraine, it all comes down to just
disabling an error in the firmware. And the second lambda continues to
provide fuel corrections.
In the Free SSM program, I see corrections for the second lambda (Learning
# 3) in the range of -2.5 .... + 2.5%

Leavo · **Posted:** Wed Sep 08, 2021 2:29 pm

Does anyone know if it is possible to eliminate the rear O2 sensor from the fuel mixture calculation completely?

I have engine EZ30D and I don't see in my ROM (D2ZX110B) any tables or parameters regarding rear O2 sensors (this engine has two).

kwwest · **Joined:** Fri Nov 19, 2021 1:28 pm **Posts:** 2

help to add in xml parameter for A2ZJA00P

RomRaider

AF#3 (Rear O2 sensor) correction limits

Who is online